Recovering from a VMWare Fusion Friendly Fire Incident

Yesterday I’d just completed a painful migration from an old Macbook Air to my new Macbook Pro. I went old-school manual due to the amount of cruft Migration Assistant had loaded the last time I used it; I guess after 10 years it was time to start fresh.

For one of my final tests, I launched VMWare Fusion (version 8.5.1) on my new Mac. It prompted me to enter my password, so it could “adjust some settings”. Which I did. Big mistake.

After about an hour of a spinning beachball, I force-rebooted the Mac. When I logged in, I got a dialog box saying my Library folder had to be repaired, with a Cancel and a Repair button. Clicking either of these immediately showed the same dialog again.

Based on this thread, it looks like there’s a really nasty bug in Fusion, where on Mac OS X 10.12.5 it somehow (by following a symlink?) changes the owner of everything on your Mac to root. That includes your user’s home directory. which makes the Mac unusable. I know the thread implies this is a very unlikely situation which also required a corrupted disk or some other problem, but I think that’s a bunch of hooey.

I wasn’t about to start over, so after several false starts, I wound up following this procedure:

Boot the Mac in “single user mode“, by holding down cmd-S during startup. I had to select an account to use, but I didn’t enter a password – seems odd.

This boots to a terminal UI, and after a few minutes the various startup messages ended. The fun part is that it’s using full resolution for the display. We’re talking 3 point text on my Macbook Pro. I’ve never felt so old, as I pretty much had to take off my glasses and press my nose against the screen to read anything.

The terminal displays some helpful hints about what commands to run next.

The first one is /sbin/fsck -fy, which checks your disk for corruption issues. That command was fine, and completed without issues.

The second one is /sbin/mount -uw /. Unfortunately on Mac OS Sierra you have to provide a filesystem type parameter (-t fstype). I tried -t hfs, but that no longer works. After a fair amount of searching I found that Sierra uses the Apple File System, which I guessed was type “apfs”. Running /sbin/mount -t apfs -uw / worked, and my disk was now mounted.

At this point I could list my home directory files via ls -l /Users/kenkrugler/, and I saw that they all had their owner/group set to root:wheel, which was wrong.

I tried to fix them up via chown -R kenkrugler:staff /Users/kenkrugler, but this failed with an error about “kenkrugler” not being a valid user.

This question on Super User explained that Mac OS X uses Directory Service, not the /etc/passwd file for keeping track of users. But when you’re booted in single user mode the Directory Service isn’t running. Luckily I found a folder that hadn’t been converted, which showed me the user as “501”, which is the raw id.

Running chown -R 501:staff /Users/kenkrugler/ took a while, and reported a number of issues with files that couldn’t be changed, but in general seemed to work.

Running exit returned me to a regular boot of my user, which worked.

So now I’m back in business, after only a few hours of pain and suffering.

Advertisements

Share this:

Like this:

LikeLoading...

Related

This entry was posted on Friday, September 1st, 2017 at 1:21 pm and is filed under Uncategorized. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.

Sorry to hear that. I was too worried that manually making changes would allow me to miss something or leave the machine vulnerable in some way. Thankfully, I had a useful back up. Strangely, Apple support didn’t even suggest time machine restore which tells you how great their support is and why I was a bit lost for a minute.

My biggest disappointment with this issue is that VMWare had documented cases and did nothing to warn registered owners of their software of the potential threat of launching their software on Sierra. I hadn’t loaded Fusion for some time, so a simple email from them could have prevented this issue.

I understand the issue is resolved with 8.5.8+, but I’m not sure if I will install it again as I haven’t had as much use for the software as I have in the past.